🎯 Pass-the-hash

The items that name it 6

• Pass-the-Passkey Family of Attacks
  writeupas classification.key entities2026-09-16
• Machine Speed is a lie: stop trying to fight AI with AI
  articleas techniques2026-09-03
• icedracon/adhammer
  repoas classification.key entities2026-07-17
• Lateral Movement Attack: Techniques, Detection & Prevention
  writeupas techniques2026-07-01

  Attackers authenticate to remote systems using a stolen NTLM password hash instead of the plaintext password, since Windows compares hashes during authentication

• elementalsouls/Claude-BugHunter
  repoas techniques2026-05-22

  internal AD attack technique; mentioned as out of scope for this bundle

• Cobalt Strike and Tradecraft
  writeupas techniques2021-07-26It is written here as Pass-the-Hash (PTH).

  Cobalt Strike's pth command uses Mimikatz to create a new Logon Session, update it with domain/username/password hash, and copy the Access Token to the new session; generates spawnto process (e.g. dllhost.exe), Event ID 4672 (new logon session), Event ID 4624 (logon), and a named pipe string identif